mirror of
https://github.com/documenso/documenso.git
synced 2026-06-22 04:12:06 +10:00
Lucas Smith
6b1b1d0417
Webhook URLs were being fetched without validating whether they resolved to private/loopback addresses, exposing the server to SSRF. Current SSRF is best effort and fail open, you should never host services that you cant risk exposure of. This extracts webhook execution into a shared module that validates URLs against private IP ranges (including DNS resolution), enforces timeouts, and disables redirect following. The resend route now queues through the job system instead of calling fetch inline.
74 lines
1.9 KiB
JSON
74 lines
1.9 KiB
JSON
{
|
|
"name": "@documenso/lib",
|
|
"version": "0.0.0",
|
|
"main": "./index.ts",
|
|
"types": "./index.ts",
|
|
"license": "MIT",
|
|
"files": [
|
|
"client-only/",
|
|
"server-only/",
|
|
"universal/"
|
|
],
|
|
"scripts": {
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"lint": "eslint .",
|
|
"lint:fix": "eslint . --fix",
|
|
"clean": "rimraf node_modules"
|
|
},
|
|
"dependencies": {
|
|
"@ai-sdk/google-vertex": "3.0.81",
|
|
"@aws-sdk/client-s3": "^3.998.0",
|
|
"@aws-sdk/client-sesv2": "^3.998.0",
|
|
"@aws-sdk/cloudfront-signer": "^3.998.0",
|
|
"@aws-sdk/s3-request-presigner": "^3.998.0",
|
|
"@aws-sdk/signature-v4-crt": "^3.998.0",
|
|
"@documenso/assets": "*",
|
|
"@documenso/email": "*",
|
|
"@documenso/prisma": "*",
|
|
"@documenso/signing": "*",
|
|
"@lingui/core": "^5.6.0",
|
|
"@lingui/macro": "^5.6.0",
|
|
"@lingui/react": "^5.6.0",
|
|
"@napi-rs/canvas": "^0.1.83",
|
|
"@noble/ciphers": "0.6.0",
|
|
"@noble/hashes": "1.8.0",
|
|
"@node-rs/bcrypt": "^1.10.7",
|
|
"@pdf-lib/fontkit": "^1.1.1",
|
|
"@scure/base": "^1.2.6",
|
|
"@simplewebauthn/server": "^13.2.2",
|
|
"@sindresorhus/slugify": "^3.0.0",
|
|
"@team-plain/typescript-sdk": "^5.11.0",
|
|
"@vvo/tzdb": "^6.196.0",
|
|
"ai": "^5.0.104",
|
|
"csv-parse": "^6.1.0",
|
|
"inngest": "^3.45.1",
|
|
"jose": "^6.1.2",
|
|
"konva": "^10.0.9",
|
|
"kysely": "0.28.8",
|
|
"luxon": "^3.7.2",
|
|
"nanoid": "^5.1.6",
|
|
"oslo": "^0.17.0",
|
|
"p-map": "^7.0.4",
|
|
"pg": "^8.16.3",
|
|
"pino": "^9.14.0",
|
|
"pino-pretty": "^13.1.2",
|
|
"playwright": "1.56.1",
|
|
"posthog-js": "^1.297.2",
|
|
"posthog-node": "4.18.0",
|
|
"react": "^18",
|
|
"remeda": "^2.32.0",
|
|
"sharp": "0.34.5",
|
|
"skia-canvas": "^3.0.8",
|
|
"stripe": "^12.18.0",
|
|
"ts-pattern": "^5.9.0",
|
|
"zod": "^3.25.76"
|
|
},
|
|
"devDependencies": {
|
|
"@playwright/browser-chromium": "1.56.1",
|
|
"@types/luxon": "^3.7.1",
|
|
"@types/pg": "^8.15.6",
|
|
"vitest": "^4.0.18"
|
|
}
|
|
}
|